fix(mcp): gate approval queue by repo maintainer scope

[JSONbored]

Motivation

• The MCP approval-queue list/decide tools used a weaker helper that allowed any session with live GitHub write permission to list or decide pending actions, bypassing the repo-scoped maintainer/owner/operator role gate and exposing/executing sensitive app-authored actions.
• The intent is to enforce the same authorization layering used by the HTTP routes: require repo-scoped Gittensory maintainer/owner/operator authority first, then verify live GitHub write permission.

Description

• Added a new helper requireRepoApprovalQueueAccess in src/mcp/server.ts that first checks repo-scoped maintainer/owner/operator scope via the session access scope and then verifies live GitHub write permission via getRepositoryCollaboratorPermission.
• Switched listPendingActions and decidePendingAction in src/mcp/server.ts to call requireRepoApprovalQueueAccess instead of the weaker requireRepoManageAccess.
• Updated unit test imports to include upsertOfficialMinerDetection and added regression tests in test/unit/mcp-automation-state.test.ts that assert a miner-only session is forbidden even when GitHub reports write access and that sessions without live write are denied.

Testing

• Ran type checking with npm run typecheck and it succeeded with no errors.
• Ran the unit tests with npx vitest run test/unit/mcp-automation-state.test.ts --reporter=verbose and all tests passed (1 test file, 17 tests total passed).

---

Codex Task

[ghost]

reviewbot — ⏳ Waiting for CI to finish before the gate review.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#941 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	408bd86	Commit Preview URL Branch Preview URL	Jun 21 2026, 06:09 AM

[codecov]

Codecov Report

❌ Patch coverage is 78.94737% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.61%. Comparing base (3086386) to head (408bd86).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/mcp/server.ts	78.94%	1 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #941      +/-   ##
==========================================
- Coverage   96.64%   96.61%   -0.03%     
==========================================
  Files         110      110              
  Lines       15041    15058      +17     
  Branches     5435     5441       +6     
==========================================
+ Hits        14536    14549      +13     
- Misses        104      105       +1     
- Partials      401      404       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.